[or-cvs] [tor/master] Fix bug in verifying directory signatures with short digests

[nickm@xxxxxxxxxxxxxx]

commit 71862ed76325a97025339ea9348e2f527a4eb940
Author: Nick Mathewson <nickm@xxxxxxxxxxxxxx>
Date:   Tue Jan 25 17:15:22 2011 -0500

    Fix bug in verifying directory signatures with short digests
    
    If we got a signed digest that was shorter than the required digest
    length, but longer than 20 bytes, we would accept it as long
    enough.... and then immediately fail when we want to check it.
    
    Fixes bug 2409; bug in 0.2.2.20-alpha; found by piebeer.
---
 changes/bug2409      |    4 ++++
 src/or/routerparse.c |    2 +-
 2 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/changes/bug2409 b/changes/bug2409
new file mode 100644
index 0000000..5523458
--- /dev/null
+++ b/changes/bug2409
@@ -0,0 +1,4 @@
+  o Minor bugfixes
+    - Resolve a bug in verifying signatures of directory objects
+      with digests longer than SHA1.  Bugfix on 0.2.2.20-alpha;
+      fixes bug 2409; found by "piebeer".
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 5ceb298..db7161e 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -1088,7 +1088,7 @@ check_signature_token(const char *digest,
   signed_digest = tor_malloc(keysize);
   if (crypto_pk_public_checksig(pkey, signed_digest, keysize,
                                 tok->object_body, tok->object_size)
-      < DIGEST_LEN) {
+      < digest_len) {
     log_warn(LD_DIR, "Error reading %s: invalid signature.", doctype);
     tor_free(signed_digest);
     return -1;